starred/hoppscotch

Fork 0

mirror of https://github.com/hoppscotch/hoppscotch.git synced 2026-04-26 01:06:00 +03:00

[GH-ISSUE #4971] [bug]: inappropriate URL decoding #1884

New issue

Closed

opened 2026-03-16 22:15:00 +03:00 by kerem · 4 comments

kerem commented

2026-03-16 22:15:00 +03:00

Owner

Originally created by @dlipofsky on GitHub (Apr 8, 2025).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/4971

Originally assigned to: @CuriousCorrelation on GitHub.

Is there an existing issue for this?

I have searched existing issues and this bug hasn't been reported yet

Current behavior

With Hoppscotch 25.3.0 when I send
http://localhost:8080/%7Bfoo%7D
it decodes the URL encodings before sending, as you can see from the netcat output

$ nc -l -p 8080
GET /{foo} HTTP/1.1
Host: localhost:8080
Accept: */*
Accept-Encoding: deflate, gzip
user-agent: HoppscotchKernel/0.1.0

Compare to curl
curl http://localhost:8080/%7Bfoo%7D
which gives

$ nc -l -p 8080
GET /%7Bfoo%7D HTTP/1.1
Host: localhost:8080
User-Agent: curl/8.7.1
Accept: */*

Hoppscotch should not be modifying the URL before sending it.

Steps to reproduce

Run a simple server on localhost:8080 which shows exactly what hoppscotch sends.
Use hoppscotch to send a GET on http://localhost:8080/%7Bfoo%7D

Logs and Screenshots

n/a

Environment

Production

Hoppscotch Version

Local

Interceptor

Not Applicable - Issue not related to network requests

Browsers Affected

No response

Operating System

MacOS

Additional Information

No response

Originally created by @dlipofsky on GitHub (Apr 8, 2025). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/4971 Originally assigned to: @CuriousCorrelation on GitHub. ### Is there an existing issue for this? - [x] I have searched existing issues and this bug hasn't been reported yet ### Current behavior With Hoppscotch 25.3.0 when I send ```http://localhost:8080/%7Bfoo%7D``` it decodes the URL encodings before sending, as you can see from the netcat output ``` $ nc -l -p 8080 GET /{foo} HTTP/1.1 Host: localhost:8080 Accept: */* Accept-Encoding: deflate, gzip user-agent: HoppscotchKernel/0.1.0 ``` Compare to curl ```curl http://localhost:8080/%7Bfoo%7D``` which gives ``` $ nc -l -p 8080 GET /%7Bfoo%7D HTTP/1.1 Host: localhost:8080 User-Agent: curl/8.7.1 Accept: */* ``` Hoppscotch should not be modifying the URL before sending it. ### Steps to reproduce 1. Run a simple server on localhost:8080 which shows exactly what hoppscotch sends. 2. Use hoppscotch to send a GET on ```http://localhost:8080/%7Bfoo%7D``` ### Logs and Screenshots ```shell n/a ``` ### Environment Production ### Hoppscotch Version Local ### Interceptor Not Applicable - Issue not related to network requests ### Browsers Affected _No response_ ### Operating System MacOS ### Additional Information _No response_

kerem

2026-03-16 22:15:00 +03:00

closed this issue
added the
bug

need testing
labels

kerem commented

2026-03-16 22:15:16 +03:00

Author

Owner

@dlipofsky commented on GitHub (Apr 11, 2025):

I also compared to Apidog, which does the right thing.

@dlipofsky commented on GitHub (Apr 11, 2025): I also compared to Apidog, which does the right thing.

kerem commented

2026-03-16 22:15:21 +03:00

Author

Owner

@Ink230 commented on GitHub (Apr 16, 2025):

Recently upgraded from some 2024.x version to 2025.3.0. This issue is now occurring for me as well.

I've tried enabling and disabling url encoding in settings to no resolution.
Behaviour is different to curl or other API clients.

@Ink230 commented on GitHub (Apr 16, 2025): Recently upgraded from some 2024.x version to 2025.3.0. This issue is now occurring for me as well. I've tried enabling and disabling url encoding in settings to no resolution. Behaviour is different to curl or other API clients.

kerem commented

2026-03-16 22:15:26 +03:00

Author

Owner

@dlipofsky commented on GitHub (Apr 28, 2025):

Has anyone read this? We've got confirmation from a second user of a clear regression.

@dlipofsky commented on GitHub (Apr 28, 2025): Has anyone read this? We've got confirmation from a second user of a clear regression.

kerem commented

2026-03-16 22:15:32 +03:00

Author

Owner

@CuriousCorrelation commented on GitHub (May 8, 2025):

Hi @dlipofsky and @Ink230,

Great news! This issue has been fixed in PR #5041, which has now been merged and is available in Hoppscotch v25.4.2-0.

Now URLs with encoded characters (like %7Bfoo%7D) will now remain properly encoded when sent. Plus parameter encoding has been improved to follow RFC 3986 standards and the implementation now correctly handles different ENCODE_MODE settings as well.

Thank you for reporting and providing clear reproduction steps, they made it much easier to identify and fix the problem.

Please update to v25.4.2 and let me know if you encounter any further issues. If you find that this problem persists after updating, please feel free to reopen this issue with details of what you're experiencing.

I'll go ahead and close this issue now that it's resolved.

@CuriousCorrelation commented on GitHub (May 8, 2025): Hi @dlipofsky and @Ink230, Great news! This issue has been fixed in PR #5041, which has now been merged and is available in Hoppscotch [v25.4.2-0](https://github.com/hoppscotch/releases/releases/tag/v25.4.2-0). Now URLs with encoded characters (like `%7Bfoo%7D`) will now remain properly encoded when sent. Plus parameter encoding has been improved to follow RFC 3986 standards and the implementation now correctly handles different `ENCODE_MODE` settings as well. Thank you for reporting and providing clear reproduction steps, they made it much easier to identify and fix the problem. Please update to `v25.4.2` and let me know if you encounter any further issues. If you find that this problem persists after updating, please feel free to reopen this issue with details of what you're experiencing. I'll go ahead and close this issue now that it's resolved.

kerem referenced this issue

2026-03-17 01:08:56 +03:00

[PR #1884] [CLOSED] chore(deps-dev): bump sass-loader from 10.2.0 to 12.2.0 #3541